Subject: GA-DIGEST V1 #1398
From: [email-masked] (GA-DIGEST)
To: [email-masked]

GA-DIGEST         Wednesday, August 28 2002         Volume 01 : Number 1398

----------------------------------------------------------------------

Date: Tue, 27 Aug 2002 23:55:26 -0700
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] WHOIS policy primer

Allan and all assembly members,

Allan Liska wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: MD5
>
> Hello Jeff,
>
> Wednesday, August 28, 2002, 12:52:20 AM, you wrote:
>
> >>
> >> Examples of times when I have needed to get in touch with a domain
> >> owner:
> >>
> >> 1. Receiving virus infected e-mails from a user of a domain.  Yes, I
> >> can /dev/null the e-mails, but I want the account cleaned up -- the
> >> ISP is not going to do that, the owner of the domain will.
>
> JW>   Some ISP's do clean these sorts of problems up if you can clearly
> JW> show what or from where/whom that potential virus came from.
> JW> However it is not up to you to act as the Domain Name Police
> JW> for viruses...
>
> Some, but not all.

  No, most but not all is more accurate...

>  Since ISPs cannot reliably be expected to clean up
> viruses, especially from customers that do not use their mail servers
> your rebuttal is invalid.

  But they can and frequently do clean up viruses.  Hence your
original argument is invalid on that point alone.  However the
rare chance that a Domain Name holder is the cause or originator
of a virus of one kind or another is still best handled by the Admin
Contact, as most Domain Name Registrants have no idea as to
how to deal with viruses...

>  It is my responsibility to protect my
> network and users, that means having to contact domains that are
> misbehaving.

  What network is that?  It is not your responsibility to contact directly
the Domain Name holder for any reason that I can think of unless
You are a registrar, Registry, or in law enforcement.  In any event,
in none of these instances is it necessary for a registrant of a Domain name
to provide there personal and private, home address, private E-Mail
address, or private Phone Number as part of the Whois record for
their Domain Name...

>
>
> >>
> >> 2. DNS mis-configuration issues.  If I run across a problem with a
> >> domain name, I need to have an address I can contact to help correct the
> >> problems.
>
> JW>   Yes and the Admin E-Mail address is there in the Whois records for
> JW> that purpose.  Hence again needing to contact the personal and private
> JW> contact physical address, Private E-Mail address, or Personal and private
> JW> Phone # is not necessary and if by doing so, could be considered a
> JW> violation of their Privacy Rights under the Privacy act...
>
> That only works if the admin address is part of the organization that
> registered the domain.

  Not true at all.  Many times I have contacted the Admin contact
for a Domain Name that was NOT part of the organization or
registrar of the Domain Name for the problem to be addressed.
The only recent exception that I can recall where this was a
problem was with IANA.ORG, DNSO.ORG and ICANN.ORG...

>  No ISP should ever make changes to a
> customer's DNS record without working with them.

  I disagree.  Mine does it for me on a regular basis based on
specific predetermined instructions or via the Admin Contact.

>
>
> I have no problem with people using a proxy e-mail that forwards to
> their ISP or hosting provider -- in fact I think it is a fine idea, as
> long as that person reading that box actually responds in a timely
> manner.

  That's good that you have no problem here.  Most reasonable
folks don't have a problem with such as well...

>
>
> >>
> >>
> >> 3. Spam, I always try to contact the owner of a domain before
> >> contacting their ISP.
>
> JW>   This also can be handled by contact the Admin E-Mail address or
> JW> other Admin contact information listed in the Whois record for that
> JW> Domain Name.  Hence again, the need to contact directly the
> JW> Registrant's Private  physical address, Private E-Mail address,
> JW> or Personal and private Phone # is not necessary and again could be
> JW> considered under the privacy act as a form of harassment or stalking
> JW> under the Federal statutes against stalking as Karl correctly mentioned
> JW> and has been done on many occasions...
>
> Again, as long as that admin address has the authority to act on
> behalf of the registrant I do not have a problem with this solution.
> But people need to understand what they are giving up.

  Well sure.  And also realize what they are gaining as well.  PRIVACY
if they choose to have it...

>
>
> >>
> >>
> >> There are other reasons for getting in touch with a domain owner
> >> directly.  For this reason it is important to have valid contact
> >> information for that domain name.
>
> JW>   Well so far, you have yet to provide one that is valid...  So I
> JW> would be glad to see or have you provide these "Other Reasons"
> JW> to which you refer.
>
> Incorrect, I provided three very valid reasons, you simply don't
> agree, but if you would like other reasons:

  No I don't JUST disagree, this has been a working method for
a number of years in Whois records for Domain Names...

>
>
> 4. When I run into a programming error on a web site, I like to let
> the site owner know.

  Thats fine!  Contact the Admin address to do that.  But this argument
is saying that I like to talk to the president of the US when I hear of see
that his administration is in error in some area.

> If no contact information is included on the
> site, I use the domain information to get ahold of someone who can
> help.

  There is.  That is the Admin contact.  Hence this argument does
not hold up under reasonable rebut...

>
>
> 5. Similarly, if I run across a potential security hole, I follow the
> same process.

  And again a security hole which I often run across can best be handled
by the Admin contact, and in no way justifies that a Registrant MUST
provide their personal and private Physical address, Private E-Mail address, or
Private Phone #

>
>
> 6. You seem to be in favor of an ISP-monitored address that people
> could use for domain problems.

  I am in favor of the registrant having the choice.  That choice may be
that ISP's or other third parties can handle monitoring some or all
of the aspects of their Domain Name(s)...

>  As overburdened as the help desks of
> most ISPs are, I doubt this is a practical or scalable solution.

  Well one of the ISP's that I use do this on a regular basis for a fee.
And I am told it is a good source of revenue for them, as well as
provides a desired service by their customers, of which I am only
one of many...

> The
> delay in support response from Eathlink, AT&T, MSN and the like often
> borders on unacceptable now, asking these same support people to now
> deal with my queries about their customer's websites seems impractical
> at best.

  I am an Netcom/Earthlink customer.  I am satisfied with their
service for my domain Names that I have that they manage for
me with my consent.  They are very responsive with concerns
that I have gotten from them on my Domain Names they manage for me.
Now AT&T is another matter entirely of course.  But you would be
best served to take that up with AT&T Management.  Perhaps
Marilyn Cade of AT&T can help you there...  So contact her
directly and perhaps she can get you  in contact with the appropriate
Person or persons at AT&T that can help more expiditiously...

>
>
> allan
> - --
> Allan Liska
> [email-masked]
> http://www.allan.org
>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6
>
> iQCVAwUAPWxGXn+n87oa5a9VAQGEKwP+LdVL4mPgqM7vA+RBlG8UR6xYx3Aan/Vw
> nxOXWyWBxwC12shGXXYFpgJdJ0PAm7SYwCItRDCQ2fG0PiZaeo5Zn4ZokBaJH8aB
> B4SMPbY3syoiqeGJR9EsKi3h+VTPbR6z+1P29s1hVIBVcxYEfKfIB2ibr3/ILoCJ
> a3tthnLcv/4=
> =ffyy
> -----END PGP SIGNATURE-----
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,
- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 127k members/stakeholders strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 972-244-3801
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 01:10:16 -0400 (EDT)
From: "Michael Froomkin - U.Miami School of Law" <[email-masked]>
Subject: Re: [ga] WHOIS policy primer

In addition to the small annoyance to many of junk e-mail, there is the
major danger to a few, of being stalked or harassed by people who found
their address in DNS records.  Yes, there are currently complex
work-arounds, but they're complex.  

On Tue, 27 Aug 2002, Don Brown wrote:

> If the availability of the WhoIs data has caused some harm to anyone,
> then it should be a point of concern.  Automobiles have also caused
> some harm, but that's a different subject.

- -- 
		Please visit http://www.icannwatch.org
A. Michael Froomkin   |    Professor of Law    |   [email-masked]
U. Miami School of Law, P.O. Box 248087, Coral Gables, FL 33124 USA
+1 (305) 284-4285  |  +1 (305) 284-6506 (fax)  |  http://www.law.tm
                      -->It's very hot here.<--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 01:11:41 -0400
From: "L. Gallegos" <[email-masked]>
Subject: Re: [ga] WHOIS policy primer

On 27 Aug 2002, at 23:50, Don Brown wrote:

> 
> If the availability of the WhoIs data has caused some harm to anyone,
> then it should be a point of concern.  Automobiles have also caused
> some harm, but that's a different subject.

We all have been told of harm caused.  It is an issue, but one that is 
ignored.  As for autos, your analogy would be like saying that the DNS 
has caused harm.  No one is saying get rid of the DNS.  If you want to 
find the owner of an auto, most states now will not just hand out the 
database information to any individual who asks.  Most states also do 
not use SSN#'s for driver's licenses and won't simply provide you with a 
driver's license number.  If you provide your SSN# or drivers' license 
number for ID purposes, you have the right to insist it not be shared by 
third parties.

> 
> Perhaps regulation of the users of the data is better and more
> absolute than revoking access to all.  Maybe that idealistic and not
> very pragmatic, but here has to be a coming together somewhere.
> 

If that were feasible, given the reasons for the existence of the Whois 
currently, I might agree.  It is not feasible, however.  First, every 
registrar and registry would have to cooperate.  Second, every country 
would have to cooperate.  ICANN and its backers are certainly NOT 
going to agree to keep the information private, are they.  Restricting 
users of the data is the same as requiring a legal order to obtain it, IMO. 
 Other than a tech contact, what would you "need" the data for?

If your use of the WHOIS is for pursuit of domain name holders, then 
you should not have access to it any more than you do for telco 
customers.  If your use is for technical admin contact, then there are 
tons of web based dig tools and always command line tools for tracing 
via IP address.  IP whois info is more accurate anyway.

Leah

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 01:27:35 -0400
From: Allan Liska <[email-masked]>
Subject: Re[2]: [ga] WHOIS policy primer

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: MD5

Hello Jeff,

Wednesday, August 28, 2002, 2:55:26 AM, you wrote:

JW> Allan and all assembly members,

JW> Allan Liska wrote:

>> -----BEGIN PGP SIGNED MESSAGE-----
>> Hash: MD5
>>
>> Hello Jeff,
>>
>> Wednesday, August 28, 2002, 12:52:20 AM, you wrote:
>>
>> >>
>> >> Examples of times when I have needed to get in touch with a domain
>> >> owner:
>> >>
>> >> 1. Receiving virus infected e-mails from a user of a domain.  Yes, I
>> >> can /dev/null the e-mails, but I want the account cleaned up -- the
>> >> ISP is not going to do that, the owner of the domain will.
>>
>> JW>   Some ISP's do clean these sorts of problems up if you can clearly
>> JW> show what or from where/whom that potential virus came from.
>> JW> However it is not up to you to act as the Domain Name Police
>> JW> for viruses...
>>
>> Some, but not all.

JW>   No, most but not all is more accurate...

>>  Since ISPs cannot reliably be expected to clean up
>> viruses, especially from customers that do not use their mail servers
>> your rebuttal is invalid.

JW>   But they can and frequently do clean up viruses.  Hence your
JW> original argument is invalid on that point alone.  However the
JW> rare chance that a Domain Name holder is the cause or originator
JW> of a virus of one kind or another is still best handled by the Admin
JW> Contact, as most Domain Name Registrants have no idea as to
JW> how to deal with viruses...

So, when was the last time Earthlink called you to tell you had a
virus?  I have worked with several large ISPS, at not one has ever
called a customer and instructed them how to clean a virus off their
machine.

No large ISP, that I am aware of, offers virus filtering on their mail
servers as the default.  If it is offered at all, it is an optional
extra service.  Of course, I have only worked with business-class
ISPs -- but they handle the bulk of the traffic on the Internet, so
their practices are probably the best to watch.

It is not a rare occurrence that a virus originates from someone
within a domain.  Melissa, Klez, and other worm/virus hybrids are all
prime examples of this.  When these types viruses hit, the quicker I
can get ahold of someone responsible for the domain, the quicker the
damage from within the domain can be contained.  Once again, the ISP
is not going to be able to run a virus scanner on their user's
desktop.  The domain administrator will.

allan
- - --
Allan Liska
[email-masked]
http://www.allan.org

- -----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUAPWxfSn+n87oa5a9VAQHCugQAidYLzcBRo4ghoxuX8oqPBTNw9egebLYz
fSH0dhShfAkGgTgY1BF4TLhH4YYdxhG+405b0ZpWdMmS2qHJgUSivdSSzgiY2dEs
+LvZSn+AsqepPpugmKkrH+jWk67lg5xTMoBlD/HzXXy95fG19w7uQ6RPdHHvS4kc
0tnCFFT6q3c=
=4ZoV
- -----END PGP SIGNATURE-----

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 01:32:16 -0400
From: Allan Liska <[email-masked]>
Subject: Re[4]: [ga] WHOIS policy primer

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: MD5

Hello L.,

Tuesday, August 27, 2002, 11:44:28 PM, you wrote:

LG> So look up the SOA for the domain (dig) and use the Postmaster
LG> address to reach the domain owner if you need to converse with
LG> him/her.  However, if the domain is being hosted by an ISP, that is
LG> where you need to make contact, not with the domain owner unless you
LG> want to purchase the domain.

Won't work, the address listed in the SOA is generally an
administrator for the DNS server, not the administrator for the
domain.  I am specifically interested in contacting someone from the
organization, not the person managing the DNS server.

>>
>> Examples of times when I have needed to get in touch with a domain
>> owner:
>>
>> 1. Receiving virus infected e-mails from a user of a domain.  Yes, I
>> can /dev/null the e-mails, but I want the account cleaned up -- the
>> ISP is not going to do that, the owner of the domain will.

LG> Not necessarily.  The ISP needs to know about the infected machine.
LG> The domain name holder may have nothing to do with the virus at all
LG> unless it is his personal machine that is infected.  The domain name
LG> has nothing to do with the virus infecting a machine.

Why would the ISP need to know about a virus infected machine?  Once
again, if you really think that is the case, the next time you get a
virus, call your ISP's NOC and tell them.  The domain has everything
to do with the virus, especially in the case of worm/virus hybrids
like Melissa and Klez.  They don't mask the sender, but that mailbox
quickly becomes full -- it needs to be killed.

- - --
Allan Liska
[email-masked]
http://www.allan.org

- -----BEGIN PGP SIGNATURE-----
Version: 2.6

iQCVAwUAPWxgZH+n87oa5a9VAQERWAQAwHqN3lS/Lfjms3bCg8VeI0UNxq29owP7
kkHPePxGhIrdMZjtMGbf3srAPiCsEGOpWTkqODu+0L1TWDAx8xLJaVFrrwMOJbO9
Q4ikZioZLO7oATTvQO1siAmZwYNyAg31ickoF4QYB+g3NYTcOkBMi7Y9yxNYIeUf
6Vz72sNKpU4=
=QxUQ
- -----END PGP SIGNATURE-----

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 02:00:57 -0400
From: "L. Gallegos" <[email-masked]>
Subject: Re: Re[4]: [ga] WHOIS policy primer

On Wednesday 28 August 2002 01:32 am, Allan Liska wrote:
> Hello L.,
>
> Tuesday, August 27, 2002, 11:44:28 PM, you wrote:
>
>
> LG> So look up the SOA for the domain (dig) and use the Postmaster
> LG> address to reach the domain owner if you need to converse with
> LG> him/her.  However, if the domain is being hosted by an ISP, that is
> LG> where you need to make contact, not with the domain owner unless you
> LG> want to purchase the domain.
>
> Won't work, the address listed in the SOA is generally an
> administrator for the DNS server, not the administrator for the
> domain.  I am specifically interested in contacting someone from the
> organization, not the person managing the DNS server.

The responsible person for the domain is the postmaster@ address for the 
domain.  If that is not accurate, what makes you think the whois information 
is accurate?

>
> >> Examples of times when I have needed to get in touch with a domain
> >> owner:
> >>
> >> 1. Receiving virus infected e-mails from a user of a domain.  Yes, I
> >> can /dev/null the e-mails, but I want the account cleaned up -- the
> >> ISP is not going to do that, the owner of the domain will.
>
> LG> Not necessarily.  The ISP needs to know about the infected machine.
> LG> The domain name holder may have nothing to do with the virus at all
> LG> unless it is his personal machine that is infected.  The domain name
> LG> has nothing to do with the virus infecting a machine.
>
> Why would the ISP need to know about a virus infected machine?  
Because that machine is passing infected mail throughout his network via his 
mail server.

Once
> again, if you really think that is the case, the next time you get a
> virus, call your ISP's NOC and tell them.  
I call the ISP for the machine that is passing the infected mail AND my ISP so 
they know the source of hte virus infection sending mail through that server.

The domain has everything
> to do with the virus, especially in the case of worm/virus hybrids
> like Melissa and Klez.  They don't mask the sender, but that mailbox
> quickly becomes full -- it needs to be killed.

Those viruses send using addresses located in the windoze address book of hte 
infected machine.  It most likely has nothing to do with the domain name 
holder at all.  I have several domains, but have never sent a virus that I 
know of based on a domain name of mine.  However, I was infected twice on my 
wincrash box which then sent out one or two infected emails before I caught 
it.  I don't have more than a couple of addresses in any windoze address 
book, so it was easy to notify those who received the infected mail.  

Agaom. it had absolutely nothing to do with any domain name I hold.  It was my 
personcal machine that received a virus from someone on this list and I was 
dumb enough to click on it.  the infected machine that sent the virus also 
had nothing to do with a domain name.  He had received the virus through an 
email and was as dumb as I was, so it sent itself to all his addressbook 
addys too.  That's how a virus works. 

Now tell me just how contacting me as a domain name holder would have any 
effect on killing the virus?  Once I had the virus, my machine was shut down 
since it killed Explorer anyway. (at least one of them did - MTX)

You keep insisting that a domain name holder is somehow responsible for a 
virus being propagated and you keep being told that it is unrelated and has 
everthing to do with individual pc's.  You still have to trace the IP address 
as the source of the virus infection, not the domain name holder. If a domain 
name holder happens to be the originator of a virus, that is a totall 
different matter and would not be up to you to trace it unless you happened 
to stumble upon it.  It is a criminal offense and up to legal enforcement 
agencies to ferret it out.  However, you are talking about the propagation of 
a virus via individual pc's email.

In the case of a website page that is propagating a virus via milicious code, 
you would want to contact the technical person hosting that website.  The 
designer or domain name holder would not help since he designed it.  I think 
yoiu would find the ISP would shut the site down pretty darn quickly once 
notified just to avoid liability.

You still have not made a case for needing the registrant information.

Leah

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 01:25:06 -0700
From: Jeff Williams <[email-masked]>
Subject: Re: [ga] WHOIS policy primer

Allan and all assembly members,

Allan Liska wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: MD5
>
> Hello Jeff,
>
> Wednesday, August 28, 2002, 2:55:26 AM, you wrote:
>
> JW> Allan and all assembly members,
>
> JW> Allan Liska wrote:
>
> >> -----BEGIN PGP SIGNED MESSAGE-----
> >> Hash: MD5
> >>
> >> Hello Jeff,
> >>
> >> Wednesday, August 28, 2002, 12:52:20 AM, you wrote:
> >>
> >> >>
> >> >> Examples of times when I have needed to get in touch with a domain
> >> >> owner:
> >> >>
> >> >> 1. Receiving virus infected e-mails from a user of a domain.  Yes, I
> >> >> can /dev/null the e-mails, but I want the account cleaned up -- the
> >> >> ISP is not going to do that, the owner of the domain will.
> >>
> >> JW>   Some ISP's do clean these sorts of problems up if you can clearly
> >> JW> show what or from where/whom that potential virus came from.
> >> JW> However it is not up to you to act as the Domain Name Police
> >> JW> for viruses...
> >>
> >> Some, but not all.
>
> JW>   No, most but not all is more accurate...
>
> >>  Since ISPs cannot reliably be expected to clean up
> >> viruses, especially from customers that do not use their mail servers
> >> your rebuttal is invalid.
>
> JW>   But they can and frequently do clean up viruses.  Hence your
> JW> original argument is invalid on that point alone.  However the
> JW> rare chance that a Domain Name holder is the cause or originator
> JW> of a virus of one kind or another is still best handled by the Admin
> JW> Contact, as most Domain Name Registrants have no idea as to
> JW> how to deal with viruses...
>
> So, when was the last time Earthlink called you to tell you had a
> virus?

  Earthlink has never called me on the phone regarding any viruses.
The have frequently sent me warning's via E-Mail when early detection of
viruses have been detected.

> I have worked with several large ISPS, at not one has ever
> called a customer and instructed them how to clean a virus off their
> machine.

  Like I said above, no I have never been called on the phone, and don't
want to be called on the phone for these sorts of concerns.  But I have
been notified by E-mail or the Admin contact(s) for my Domain Names I have
under management by the ISP's I do business with on quite a few
occasions...  They, the warning E-Mail's, are commonly called "Virus Alerts".
Perhaps you have had the chance to have heard of them.  I am also notified
as well by other orgs such as Sans.org, of "Virus Alerts" as well...

>
>
> No large ISP, that I am aware of, offers virus filtering on their mail
> servers as the default.

  Netcom/Earthlink does...  I have never gotten bitten by a Virus
on my Earthlink accounts or on any of my Domains they have hosted
for me.

> If it is offered at all, it is an optional
> extra service.

  Not for E-Mail at Netcom/Earthlink.  It is part of their standard service...

>  Of course, I have only worked with business-class
> ISPs -- but they handle the bulk of the traffic on the Internet, so
> their practices are probably the best to watch.

  Depends of which business class ISP's you are referring to as to
whether they are "probably the best to watch".  I certainly would
not say AOL, AT&T or MSN as being one of those business class
ISP's that are "probably the best to watch".  In fact Juno/Netzero
do a much better job in this area...

>
>
> It is not a rare occurrence that a virus originates from someone
> within a domain.

  I have yet to see one in some time now...  Sans.org as well as other
Virus watch and tracking organizations that I am a member of
do not show any in some time now...

> Melissa, Klez, and other worm/virus hybrids are all
> prime examples of this.

  Examples of what?  Those were not originated at DNS or from any
particular Domain Name.

>  When these types viruses hit, the quicker I
> can get ahold of someone responsible for the domain, the quicker the
> damage from within the domain can be contained.  Once again, the ISP
> is not going to be able to run a virus scanner on their user's
> desktop.  The domain administrator will.

  First of all, if you are making the argument that containing the
questionable
case that the virus originated from a particular Domain Name and than saying
that
the ISP cannot run a virus scan on anyone's particular desktop, you are
arguing
in reverse.  That being that if containing such a highly questionable and
certainly
rare Domain Name originated Virus and than making the case in the reverse
to a some individuals Desktop PC, than containment is not an issue.  Hence,
this argument is fallacious to that extent.

>
>
> allan
> - --
> Allan Liska
> [email-masked]
> http://www.allan.org
>
> -----BEGIN PGP SIGNATURE-----
> Version: 2.6
>
> iQCVAwUAPWxfSn+n87oa5a9VAQHCugQAidYLzcBRo4ghoxuX8oqPBTNw9egebLYz
> fSH0dhShfAkGgTgY1BF4TLhH4YYdxhG+405b0ZpWdMmS2qHJgUSivdSSzgiY2dEs
> +LvZSn+AsqepPpugmKkrH+jWk67lg5xTMoBlD/HzXXy95fG19w7uQ6RPdHHvS4kc
> 0tnCFFT6q3c=
> =4ZoV
> -----END PGP SIGNATURE-----
>
> --
> This message was passed to you via the [email-masked] list.
> Send mail to [email-masked] to unsubscribe
> ("unsubscribe ga" in the body of the message).
> Archives at http://www.dnso.org/archives.html

Regards,

- --
Jeffrey A. Williams
Spokesman for INEGroup - (Over 127k members/stakeholders strong!)
CEO/DIR. Internet Network Eng/SR. Java/CORBA Development Eng.
Information Network Eng. Group. INEG. INC.
E-Mail [email-masked]
Contact Number: 214-244-4827 or 972-244-3801
Address: 5 East Kirkwood Blvd. Grapevine Texas 75208

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 00:24:04 -0700 (PDT)
From: Karl Auerbach <[email-masked]>
Subject: Re[2]: [ga] WHOIS policy primer

On Wed, 28 Aug 2002, Allan Liska wrote:

> KA> Why should one who is on the net be required to have e-mail?
> 
> One who is on the Internet is not required to have e-mail.  One who
> has a domain name has  certain responsibilities, and must have an
> e-mail.  In fact, at a minimum, all domain owners are required to have
> a postmaster@ address.

At the risk of reaching my posting limit - you are simply asserting these
things.  There have *never* been "responsibilities" associated with having
a domain name beyond having a couple of servers geographically separated
(a requirement often ignorred.) There has *never* been a requirement that
there be a "postmaster" address - and that would be a strange requirement
indeed in these days of people who think of the net as a web-only
experience.

And why should there be an open public book of who-owns-what-domain name?  
If that machines legitimately bearing that domain name are not hurting you 
then why do you have any right to know who owns them?

If they are hurting you, then we have a legal system that will give you 
the tools (subpoenas and such) to pry out the information that you need.

If they are hurting you badly enough that immediate action is required - 
we are not a vigalante society and you ought to be acting through "the 
authorities".  Yes, they aren't very helpful yet - but perhaps that is 
because they are not usually asked to help.

> KA> You have not said why one must reveal one's identity and address and phone
> KA> number to the public for unregulated data mining.  What values are
> KA> promoted by such disclosures?
> 
> I didn't say they should reveal the address for public data mining.
> In fact many registrars are taking steps to prevent data mining of
> whois databases, I applaud those steps.  That does not mean that there
> should not be a valid contact information for all domains, one who can
> speak authoritatively for the organization.

Let's consider bagpipe owners - those wind bags can be more than merely
annoying if abused.  Should we as a society require that every person who
purchases (or builds) a bagpipe have to put his name, address, and phone
number onto a public ledger so that any cocamamie marketeer can bombard
the bagpipe player with spam?  Is the fact that you (or I) might
occassionally need to find out whose bag is anoying you at midnight be
reason to have such a public ledger?

As a general matter, public ledgers of names have been required only for 
real property (land) and dangerous instrumentalities (not even guns are 
always on publicly accessible ledgers).

Domain names are more like bagpipes than they are like guns and they 
equally ought to be off lists that can be accessed by anybody, anytime, 
for any reason, and without leaving a verifiable calling card.
 
> That is a misnomer, it is very easy to forge an IP Address, in fact,
> it is done all the time.  The problem with the TCP handshake, is that
> the receiving end always believes the sender is who he says he is.

Uh, you are mistaken.  Sure, it is easy to forge *source* addresses, but
if a forged address is used as a *destination*, the packet won't get back
to where it came from.  TCP handshakes will fail and connections will not
be formed.  There is nothing in TCP that "believes" or doesn't "believe" - 
the simple fact is that the return packet will never arrive if the 
destination address is forged.

> ..  DNS is all about being cooperative.

DNS is about partitioning up the name space so that different groups can
work without consulting one another.  IP addresses, on the other hand,
require allocation that is consistent with the topology and routing
protocols of the net.

> Why would I e-mail a NOC because an end user of an end user has a
> virus on one of their workstations?  That's ludicrous, and any good
> NOC engineer will laugh at you for that type of request.

For this you want to violate the privacy of everyone who has a domain on 
the net?

> Well, it is sort of like writing a check.  I may not want every
> cashier at Target to have my address, but if I want to write checks, I
> don't have any choice -- if I want privacy, I can pay cash.  If you
> want to maintain privacy on the Internet, don't register a domain
> name.

Given that the Internet is evolving into a utility function you are asking 
people to pay a very steep, and unnecessary price to obtain a utility.  
Why should a parent expose the name and address of a schoolchild just so 
that child can get his/her homework of the school's web page?

> Also, as I have stated in the past, I have no objection to using proxy
> information as DNS contacts, as long as the person on the other side
> of the e-mail is responsive to queries.

If those queries are called "subpoenas" and are issued only after a 
demonstration of adequate cause and adequate evidence before a 
disinterested magistrate, then fine.  Otherwise, you are opening the door 
to those who chose to sell us everything, to stalk our children, and to 
reduce individuals to mere numbers.

		--karl--

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 10:32:16 +0200
From: Alexander Svensson <[email-masked]>
Subject: [ga] FYI: Mueller (sort of) pro WLS

"Mueller speaks out on WLS (Warning: here be heresy)"
http://www.icannwatch.org/article.php?sid=921&mode=&order=0

Interesting read!
/// Alexander

- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 11:08:10 +0200 (MET DST)
From: Elisabeth Porteneuve <[email-masked]>
Subject: Re: Re[2]: [ga] WHOIS policy primer

Karl Auerbach <[email-masked]> replied to Allan Liska:
> 
> On Wed, 28 Aug 2002, Allan Liska wrote:
> 
> > KA> Why should one who is on the net be required to have e-mail?
> > 
> > One who is on the Internet is not required to have e-mail.  One who
> > has a domain name has  certain responsibilities, and must have an
> > e-mail.  In fact, at a minimum, all domain owners are required to have
> > a postmaster@ address.
> 
> At the risk of reaching my posting limit - you are simply asserting these
> things.  There have *never* been "responsibilities" associated with having
> a domain name beyond having a couple of servers geographically separated
> (a requirement often ignorred.) There has *never* been a requirement that
> there be a "postmaster" address - and that would be a strange requirement
> indeed in these days of people who think of the net as a web-only
> experience.
> 

Humm, I respectifuly disagree.
At least two name servers, yes, but I do not recall "a couple of servers
geographically separated" as requirement.

The RFC1591 http://www.isi.edu/in-notes/rfc1591.txt
stands for all domain names, not only TLD, and is explicit
on recursivity (which includes email connectivity).
The "postmaster" comes from RFC1123 if I recall, and says that
that email connectivity to a "domain.tld", imply at least 
[email-masked] (i.e. the one who deals with the SMTP).

<quote>
   1) The key requirement is that for each domain there be a designated
      manager for supervising that domain's name space.  In the case of
      top-level domains that are country codes this means that there is
      a manager that supervises the domain names and operates the domain
      name system in that country.

      The manager must, of course, be on the Internet.  There must be
      Internet Protocol (IP) connectivity to the nameservers and email
      connectivity to the management and staff of the manager.

      There must be an administrative contact and a technical contact
      for each domain.  For top-level domains that are country codes at
      least the administrative contact must reside in the country
      involved.
</quote>

<quote>
      There are no requirements on subdomains of top-level domains
      beyond the requirements on higher-level domains themselves.  That
      is, the requirements in this memo are applied recursively.
</quote>

Elisabeth
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

Date: Wed, 28 Aug 2002 14:18:43 +0200
From: Vittorio Bertola <[email-masked]>
Subject: [ga] my comments to the WHOIS Task Force report

Comments on the "Possible Recommendations" of the DNSO WHOIS Task
Force Report

Vittorio Bertola
August 28, 2002

This document exposes my comments to the "Possible Recommendations"
section of the Report of the WHOIS Task Force of DNSO's Names Council.
These comments are personal and do not reflect the view of any of the
entities I am involved with (i.e. ISOC Italy, icannatlarge.com, or the
At Large Organizing Committee). However, they have matured after
careful reading of the discussions on the DNSO GA list and on other
ICANN-related lists, mainly populated by users and individual domain
name owners. So, while I do not claim that the following statements
represent the opinions of these constituencies, I know that they are
shared by a number of their members.

A.	Accuracy of data contained in the WHOIS database

The need of having accurate data listed in the WHOIS service is
agreeable. 

First of all, I note that the only entity able to guarantee the
freshness of the data is the registrant - so if accuracy has to be
granted, the registrant must be deeply involved in the process.
However, if the registrant is to be required to keep its contact data
updated - especially if failure to do so might mean getting penalties
of any kind - then the registrar is to be clearly required to offer
registrants a simple mechanism (ie Web and/or e-mail based) to check
and update his contact data, as a provision in the RAA. Especially in
ccTLDs, there are cases where, as a result of privacy protection
measures, the registrant himself is unable even just to check the
information currently listed for his domain.  However, to protect the
registrant's privacy, such mechanism should be made available to the
registrant only, via an authentication scheme established at the time
of the domain registration.

Also, I suggest that it is more likely that registrants keep their
data updated if they are asked to give them in one and only one place.
So, at least in the mid term, it should be established a system not to
duplicate contact data across the various TLDs, for example in one of
the following ways:
·	Creation of a centralized "Identity Registry" (for individuals
and organizations) to which all WHOIS databases point with a standard
identity handle, and which all registries use to store and retrieve
the contact data;
·	Introduction of standard cross-TLD identity handles in all
WHOIS databases, so that, when registering a domain, the registrant
can point to his contact data as already provided to the
registrar/registry of another TLD.
This of course requires complete standardization of the data set
required to identify individuals and organizations in the DNS system.

Finally, I note that having an accurate WHOIS database under the
registry's control does not imply that such database has to be made
fully and easily available to whoever desires to read it. The Task
Force Report should stress that this point deserves better
consideration in all future agreements and policy-making processes. I
will deal with more detail with privacy issues when commenting section
C - but I have to note that the current, total lack of privacy about
the registrants' personal information is a strong incentive for people
and companies to purposedly provide invalid or incorrect contact data.
Given the scale of the DNS and the difficulty in checking the
veridicity of personal information for entities scattered around the
whole world, I think that even the introduction of penalties of any
kind will not particularly help to get better accuracy in WHOIS
information if a certain degree of guaranteed privacy is not
introduced. (And by the way, in many countries it is extremely dubious
that a WHOIS system that does not offer such privacy guarantees abides
by the privacy protection laws.)

B.	Uniformity of data formats

As already stated, I think that uniformity of data formats is a
necessary precondition to get better accuracy in WHOIS data.

Especially for individuals and companies that own domains across a
number of different TLDs, it is practically impossible to cope with
the huge number of different data sets, input systems and local
conventions that are currently used. So the agreement by all gTLD and
ccTLD registries upon an uniform set of data to identify DNS entities
is absolutely necessary. ICANN should try to foster such agreement,
work with all gTLD and ccTLDs to reach it, and later force its
adoption (with reasonable phase-in times) in its contracts with gTLD
and ccTLD registries.

C.	Better searchability of WHOIS databases

Personally, I absolutely cannot see any need for better searchability
of WHOIS databases, and especially for queries that might return more
than one domain name at a time. In fact, I only see the need for
reducing the access to WHOIS databases, to enforce a higher degree of
privacy protection, and to avoid the current widespread use of WHOIS
information for unsolicited e-mail and other unwanted marketing uses.
Such higher degree of protection is clearly requested by the Internet
community, as shown by the responses to the Task Force survey.

Registrants should be able to choose whether their personal data are
to be publicly accessed through WHOIS queries, or not; they should
have the option of accepting public distribution of their data, within
a separate opt-in part of the registration agreement, when registering
the domain. The implementation of this option should be required to
registrars and registries; in fact, the absence of this option is very
likely to make the whole WHOIS system illegal, at least under the laws
of the European Union. The only exception to this should be the
availability of a technical contact point e-mail (and, optionally,
telephone and fax numbers), which should be made available via WHOIS
queries on a per-domain basis; this can be justified (also in front of
the law) as a necessary instrument for providing the DNS service.
Also, the availability and functionality of the postmaster@domain
e-mail address should be required in all domain registration
agreements.

In any case where access to other WHOIS data (for example, the
identity of the registrant) is necessary for law enforcement purposes,
there already are laws that give law enforcement agencies the
necessary instruments to access such information even if it is not
accessible via WHOIS queries. In fact, to speed this up, registries
could be required to establish separate, private accesses, to be
reserved to officers of the appropriate law enforcement bodies, that
can offer full access and searchability to their databases. 

D.	Marketing use of WHOIS data

Generally speaking (and as required by many national privacy laws),
registrants have to be provided with options to opt in or out from any
kind of usage, distribution and processing of their data that is not
strictly necessary to supply the DNS service; these options must be
clearly stated, separated from the core of the domain registration
agreement, and it must be absolutely clear to customers that they can
register the domain name even if they do not accept to provide their
personal information for these additional uses.

This means that, for example, all registrars should be required to
structure their registration forms, either Web- or paper-based, with
separate options for opting in to any kind of bulk access - even if
not aimed at marketing purposes - or marketing usage of their data.
Registrars and registries must not be able to refuse registrations due
to the user's wish not to opt in to these additional uses.
- -- 
vb.               [Vittorio Bertola - v.bertola [a] bertola.eu.org]<------
- ----------------------> http://bertola.eu.org/ <--------------------------
- --
This message was passed to you via the [email-masked] list.
Send mail to [email-masked] to unsubscribe
("unsubscribe ga" in the body of the message).
Archives at http://www.dnso.org/archives.html

------------------------------

End of GA-DIGEST V1 #1398
*************************